More trojan infections

Eric · December 3, 2009

After this thread (http://support.emsisoft.com/topic/581-trojan-and-possible-rootkit-infection/) we have had a couple weeks of trouble-free operations. Now, however, my wife noticed that links from a google search were being hijacked. I ran a scan and immediately found more trojans. logs are attached.

Once again, help would be very much appreciated.

Lynx · December 3, 2009

Hi Eric,

- re: C:\Program Files\Microsoft Office\Office\SBT\SBCM\SBCMAUT.EXE detected: Gen.Trojan!IK

Please submit the file from the detection list irrespectively

See this case that could be FP

- as for System Restore Point flaggings - disable it - set it “Off” reboot and set it back “On”

- you shouldn't have ran Win32Diag, since a-squared's report does not meet the conditions described in the instruction

After that please update a-squared; rerun Deep Scan and attach fresh log files

My regards

ShadowPuterDude · December 3, 2009

Download ComboFix from one of these locations:

Save as Combo-Fix.exe during the download. ComboFix must be renamed before you download to your Desktop

Link 1

Link 2

Link 3

* IMPORTANT !!! Save Combo-Fix to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
See HERE for help
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, ComboFix will produce a log.

Note:

1. Do not mouseclick combofix's window while it's running. That may cause it to stall!

2. Remember to re-enable your anti-virus and anti-spyware before reconnecting to the Internet.

-----------------------------------------------------------

Attach fresh logs for:

ComboFix (C:\combofix.txt)
a-squared Free/Anti-Malware
ISeeYouXP
HiJackFree

Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now!

Eric · December 5, 2009

When I ran combofix, a message came up that said that rootkit activity was discovered. It rebooted the computer and continued.

It seems that google search results are no longer hijacked so that is a very good sign. Logs are attached. What next?

ShadowPuterDude · December 5, 2009

Copy the contents of the below quote box to Notepad; Save As FixReg.reg to your Desktop; make sure File Type: is set to All Files (*.*).

REGEDIT4

[-HKEY_USERS\S-1-5-21-2178475379-1560192793-155487171-1006\Software\SAV]

Close Notepad.

Locate FixReg.reg on your Desktop. Double-click on it and answer 'Yes' when asked if you want to merge with the registry.

-----------------------------------------------------------

Download Avenger from HERE and unzip to your desktop.

Run Avenger
Read the prompt that appears, and press OK

Copy & paste the following text in Input script Box:

Files to delete:
C:\Documents and Settings\Jen\Desktop\Downloads\win_protection_update(2).exe
C:\Documents and Settings\Jen\Desktop\Downloads\win_protection_update(3).exe
C:\Documents and Settings\Jen\Desktop\Downloads\win_protection_update(4).exe
C:\Documents and Settings\Jen\Desktop\Downloads\win_protection_update.exe

Then click "Execute".

You will be presented with 2 confirmation prompts. Select yes on each. Your system will reboot.
Note: It is possible that Avenger will reboot your system TWICE.
Upon reboot, a command prompt window will appear on your screen for a few seconds, and then Avenger's log will open. Please paste that log here in your next post.

-----------------------------------------------------------

Attach fresh logs for:

Avenger (C:\avenger.txt)
a-squared Free/Anti-Malware

Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now!

Eric · December 5, 2009

Things seem to be running ok right now. Avenger did not find any rootkits, but Asquared is still showing trojans. Also, the computer experienced a bsod before I followed the latest instructions. It rebooted ok, and so far that has not recurred. Newest logs are attached. Thanks for all the help so far.

ShadowPuterDude · December 7, 2009

C:\Program Files\Microsoft Office\Office\SBT\SBCM\SBCMAUT.EXE 	detected: Gen.Trojan!IK

False Postive. Submit to EMSI.

C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\atapi.sys.vir 	detected: Rootkit.Win32.TDSS!IK
C:\Qoobox\Quarantine\C\WINDOWS\system32\logon.exe.vir 	detected: Trojan.Win32.Bredolab!IK

Inactive. Quarantined by ComboFix.

C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1\A0000011.EXE 	detected: Gen.Trojan!IK
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1\A0000040.exe 	detected: Virus.Win32.Rootkit!IK
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP27\A0008249.exe 	detected: Trojan.Win32.Bredolab!IK
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP27\A0009234.exe/pc.exe 	detected: Trojan.Win32.FakeAV!IK
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP27\A0009234.exe/agent.exe 	detected: Trojan.Win32.FakeAV!IK
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP27\A0009234.exe/guide.html 	detected: Fraudload!IK
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP27\A0009235.exe/pc.exe 	detected: Trojan.Win32.FakeAV!IK
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP27\A0009235.exe/agent.exe 	detected: Trojan.Win32.FakeAV!IK
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP27\A0009235.exe/guide.html 	detected: Fraudload!IK
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP27\A0009236.exe/pc.exe 	detected: Trojan.Win32.FakeAV!IK
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP27\A0009236.exe/agent.exe 	detected: Trojan.Win32.FakeAV!IK
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP27\A0009236.exe/guide.html 	detected: Fraudload!IK
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP27\A0009237.exe/pc.exe 	detected: Trojan.Win32.FakeAV!IK
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP27\A0009237.exe/agent.exe 	detected: Trojan.Win32.FakeAV!IK
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP27\A0009237.exe/guide.html 	detected: Fraudload!IK

Inactive. System Retore Point.

Antivirus Tools Cannot Clean Infected Files in the System Restore Folder.

The System Restore feature in Windows protects all folders and files in the System Restore folder on the Windows partition. This folder and all of its subfolders are the data store that the System Restore feature uses to restore your computer's operating system to a previous state from a previous point in time.

Although some antivirus programs may have the ability to work with files that have been compressed or stored in .zip or .cab file format, the System Restore feature does not permit these utilities to manipulate these files within the data store. The data store is protected for data integrity purposes, and the System Restore feature is the only method you can use to obtain access to the data store. Because of this, the antivirus program is unable to remove the virus from the file or files in the data store. The files in the data store are inactive and can be used only by the System Restore feature.

-----------------------------------------------------------

Your logs look fine.

Unless you are having problems from Malware it is time to do the final steps.

If you used ComboFix, uninstall ComboFix:

Click START then RUN and enter the below into the run box and then click OK. (Use only the command of the same name as your copy of combofix.)
AvoidTDSS /uninstall or combofix /uninstall or Combo-Fix /uninstall
Note: The space before /uninstall, must be there. Which command you use depends on if I had you rename ComboFix during download.
This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Delete everything in C:\!KillBox (If I didn't have you use KillBox, then this won't be present)

Delete the following from your Desktop (If they exist)

Avenger.exe

Avenger.txt

Avenger.zip

CFscript.txt

dds.scr

dds.pif

DisableAutoRuns.reg

fixes.bat

FixMe.reg

FixReg.reg

ISeeYouXP.exe

ISeeYouXP.lnk

ISeeYouXP.txt

Win32kDiag.exe

Win32kDiag.txt

Anything else I had you use

Delete the following files: (If they exist)

C:\Avenger.txt

C:\ComboFix.txt

Delete the following folders: (If they exist)

C:\Avenger

C:\AvoidTDSSS

C:\ComboFix

C:\SDFix

C:\Qoobox

You can delete and uninstall any programs I had you download, that you do not wish to keep on the system.

Empty the Recycle Bin

Run CCleaner

Turn off System restore to flush all your restore points then turn system restore back on.

To manually turn off System Restore, follow these steps:

1. Click Start, right-click My Computer, and then click Properties.

2. Click the System Restore tab.

3. Click to select the Turn off System Restore check box (or the Turn off System Restore on all drives check box), and then click OK.

4. Click Yes when you receive the prompt to the turn off System Restore.

To turn on System Restore, follow these steps:

1. Click Start, right-click My Computer, and then click Properties.

2. Click the System Restore tab.

3. Click to clear the Turn off System Restore check box (or the Turn off System Restore on all drives check box), and then click OK.

Delete C:\ISeeYouXP

Run Windows Update and update your Windows Operating System.

Run the Secunia Online Software Inspector, this will inspect your system for software that is out-of-date and in need of updating. Update anything program/application detected as being out-dated.

That should take care of everything.

Safe Surfing!

Eric · December 8, 2009

Before I go through the finishing-up steps, there was a trojan warning through Avast yesterday. This occurred after following the previous instructions (while waiting for your reply). I have attached a screen shot of the Avast log. Is this indicating that a problem still exists, is it a residual or false positive, or did Avast prevent a new problem? Thanks.

Lynx · December 8, 2009

Hi Eric,

Irrespectively, please attach the report from Avast (not just an image)

and submit files to Avast developers

That's not easy (takes more time ) to research all entries when it's a "picture"

Sure entries like a-squared being flagged could be FP

My regards

Eric · December 10, 2009

Sorry about that... somehow missed the export option when I first looked at it. Here is the log file. Working on passing the info to Avast right after submitting this reply. Primarily it is the entry dated 12/6 that concerns me since this was after all of the cleaning we did on the system.

ShadowPuterDude · December 10, 2009

Something is still attempting to download malicious items from the internet.

Download RootRepeal.zip and unzip it to your Desktop.

Double click RootRepeal.exe to start the program

Click on the Report tab at the bottom of the program window

Click the Scan button

In the Select Scan dialog, check:

Drivers
Files
Processes
SSDT
Stealth Objects
Hidden Services

Click the OK button

In the next dialog, select all drives showing

Click OK to start the scan

Note: The scan can take some time. DO NOT run any other programs while the scan is running

When the scan is complete, the Save Report button will become available. Click this and save the report to your Desktop as RootRepeal.txt

Go to File, then Exit to close the program

Attach it to your reply.

Eric · December 11, 2009

Here is the root repeal log...

ShadowPuterDude · December 12, 2009

OK, no RootKits where found by RootRepeal.

One more tool.

Download -->> OTL <<-- to your desktop.

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Check the boxes beside LOP Check and Purity Check.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
- When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt.
  Note: These logs can be located in the OTL. folder on you C:\ drive if they fail to open automatically.
- Attach both logs with your next reply.

Eric · December 13, 2009

OTL Log File attached, but the Extras file never opened, and there is no OTL folder on the c: drive.

ShadowPuterDude · December 13, 2009

Run OTL.exe

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

:OTL
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
SRV - (winvnc) --  File not found
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No CLSID value found.
O4 - Startup: C:\Documents and Settings\Jen\Start Menu\Programs\StartUp\SyncBackSE.lnk = C:\Program Files\SyncBackSE\SyncBackSE.exe File not found
O32 - AutoRun File - [2004/08/04 06:00:00 | 00,000,110 | R--- | M] () - D:\AUTORUN.INF -- [ CDFS ]

:Files
C:\WINDOWS\*.tmp
C:\WINDOWS\System32\*.tmp
C:\WINDOWS\System32\drivers\*.tmp
C:\Program Files\error.dat

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Attach the new OTL log ( don't check the boxes beside LOP Check or Purity this time )

Eric · December 14, 2009

Done. Log attached.

ShadowPuterDude · December 14, 2009

Everything looks good. How are things running?

Eric · December 14, 2009

no new problems. seems to be running ok. are there final cleanup steps then?

ShadowPuterDude · December 15, 2009

Your logs look fine.

Unless you are having problems from Malware it is time to do the final steps.

If you used ComboFix, uninstall ComboFix:

Click START then RUN and enter the below into the run box and then click OK. (Use only the command of the same name as your copy of combofix.)
AvoidTDSS /uninstall or combofix /uninstall or Combo-Fix /uninstall
Note: The space before /uninstall, must be there. Which command you use depends on if I had you rename ComboFix during download.
This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Delete everything in C:\!KillBox (If I didn't have you use KillBox, then this won't be present)

Delete the following from your Desktop (If they exist)

Avenger.exe

Avenger.txt

Avenger.zip

CFscript.txt

dds.scr

dds.pif

DisableAutoRuns.reg

fixes.bat

FixMe.reg

FixReg.reg

ISeeYouXP.exe

ISeeYouXP.lnk

ISeeYouXP.txt

Win32kDiag.exe

Win32kDiag.txt

Anything else I had you use

Delete the following files: (If they exist)

C:\Avenger.txt

C:\ComboFix.txt

Delete the following folders: (If they exist)

C:\Avenger

C:\AvoidTDSSS

C:\ComboFix

C:\SDFix

C:\Qoobox

You can delete and uninstall any programs I had you download, that you do not wish to keep on the system.

Empty the Recycle Bin

Run CCleaner

Turn off System restore to flush all your restore points then turn system restore back on.

To manually turn off System Restore, follow these steps:

1. Click Start, right-click My Computer, and then click Properties.

2. Click the System Restore tab.

3. Click to select the Turn off System Restore check box (or the Turn off System Restore on all drives check box), and then click OK.

4. Click Yes when you receive the prompt to the turn off System Restore.

To turn on System Restore, follow these steps:

1. Click Start, right-click My Computer, and then click Properties.

2. Click the System Restore tab.

3. Click to clear the Turn off System Restore check box (or the Turn off System Restore on all drives check box), and then click OK.

Delete C:\ISeeYouXP

Run Windows Update and update your Windows Operating System.

Run the Secunia Online Software Inspector, this will inspect your system for software that is out-of-date and in need of updating. Update anything program/application detected as being out-dated.

That should take care of everything.

Safe Surfing!

Eric · December 18, 2009

Once again, before I started the final steps, Avast popped up with another virus warning. see attached log (today's entry).

ShadowPuterDude · December 19, 2009

That is alerting on a web page.

ShadowPuterDude · December 22, 2009

Thread Closed

Reason: Resolved

The procedures contained in this thread are for this user and this user only. Attempting to use the instructions in this thread on your system could result in damaging the Operating System beyond repair. Do Not use any of the tools mentioned in this thread without the supervision of a Malware Removal Specialist.

All posters requesting Malware Removal assistance are required to follow all procedures in the thread titled START HERE, if you don't we are just going to send you back to this thread

Sign In

More trojan infections

Recommended Posts

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Recently Browsing 0 members

Products & Services

Ransomware/Malware Removal

Partners

Resources

Company